Determining device and determining method for determining processing to be performed based on acquired data

ABSTRACT

The present invention provides a technique for determining processing to be performed at high speed. When processing to be performed is determined through multiple condition judgments and branches, a comparison target extraction circuit extracts from acquired data multiple pieces of determination data used for the condition judgments and branches and connects the pieces to generate comparison target data. A first database and a second database store reference data generated by connecting a possible value of each of multiple pieces of determination data and also store a processing content to be performed, in which the reference data and the processing content are related to each other. A binary search circuit collectively conducts multiple condition judgments and branches by searching the first database for comparison target data and outputs a processing content to be performed.

TECHNICAL FIELD

The present invention relates to a technique for determining processingto be performed, and particularly to a determination apparatus and adetermination method for determining processing to be performed based onacquired data.

BACKGROUND ART

Due to improved Internet infrastructures and the widespread ofcommunication terminals, such as cellular phone terminals, personalcomputers, and VoIP (Voice over Internet Protocol) phone sets, thenumber of Internet users is now exploding. Under such circumstances,security problems such as computer viruses, hacking and spam mails havebecome apparent, requiring appropriate techniques for communicationcontrol.

The Internet has enabled easy access to a vast amount of information. Onthe other hand, harmful information is proliferating thereon andregulation on its originator does not keep up with the proliferation. Toprovide an environment where everyone can use the Internet safely andeffectively, there is required an appropriate technique for controllingaccess to harmful contents.

[Patent Document 1] WO 2006-087832

DISCLOSURE OF THE INVENTION Problem to be Solved by the Invention

The present applicant has proposed a technique for enabling high-speedcommunication control in Patent Document 1. Aiming to further speed upthe operation, the applicant has conceived of another technique forenabling more high-speed communication control.

The present invention has been made in view of such a situation, and apurpose thereof is to provide a technique for determining processing tobe performed at high speed.

Means for Solving the Problem

One aspect of the present invention relates to a determinationapparatus. The determination apparatus comprises: a comparison targetextraction circuit which, when processing to be performed is determinedthrough a plurality of condition judgments and branches, extracts fromacquired data a plurality of pieces of determination data used for thecondition judgments and branches and connects the plurality of pieces ofdetermination data to generate comparison target data; a database whichstores reference data generated by connecting a possible value of eachof the plurality of pieces of determination data and also stores aprocessing content to be performed determined through the plurality ofcondition judgments and branches based on the combination of the valuesof the plurality of pieces of determination data included in thereference data, the reference data and the processing content beingrelated to each other; and a search circuit which collectively conductsthe plurality of condition judgments and branches by searching thedatabase for the comparison target data and which outputs a processingcontent to be performed related to the reference data that matches thecomparison target data.

When there is a piece of determination data that is not used in theplurality of condition judgments and branches within the combination ofthe values of the plurality of pieces of determination data included inreference data, the piece of determination data may be masked therein.

Another aspect of the present invention also relates to a determinationapparatus. The determination apparatus comprises: a comparison targetextraction circuit which, when processing to be performed is determinedthrough a plurality of condition judgments and branches, extracts, fromacquired data, comparison target data predefined so as to include aplurality of pieces of determination data used for the conditionjudgments and branches; a database which stores reference data having adata length identical with that of the comparison target data andcontaining a possible value of each of the plurality of pieces ofdetermination data at the position of the piece of determination dataand which also stores a processing content to be performed determinedthrough the plurality of condition judgments and branches based on thecombination of the values of the plurality of pieces of determinationdata included in the reference data, the reference data and theprocessing content being related to each other; and a search circuitwhich collectively conducts the plurality of condition judgments andbranches by searching the database for the comparison target data inwhich each piece of data other than the plurality of pieces ofdetermination data is masked, and which outputs a processing content tobe performed related to the reference data that matches the comparisontarget data.

The determination apparatus may further comprise a comparison targetsetting circuit which specifies a plurality of pieces of determinationdata to be extracted by the comparison target extraction circuit. Thedetermination apparatus may comprise a plurality of the databases, and,when changing a plurality of pieces of determination data to beextracted by the comparison target extraction circuit, the comparisontarget setting circuit may also replace the database searched by thesearch circuit accordingly.

The determination apparatus may further comprise a reporting circuitwhich, when the comparison target data does not match any of thereference data, reports the fact. The database may be configured to beupdatable from the outside so as to be replaced by a new database inwhich is added a record in regard to comparison target data that has notmatched any of the reference data.

Yet another aspect of the present invention relates to a determinationmethod. The determination method comprises: extracting, when processingto be performed is determined through a plurality of condition judgmentsand branches, a plurality of pieces of determination data used for thecondition judgments and branches from acquired data and connecting theplurality of pieces of determination data to generate comparison targetdata; and collectively conducting the plurality of condition judgmentsand branches by searching for the comparison target data within adatabase, which stores reference data generated by connecting a possiblevalue of each of the plurality of pieces of determination data and alsostores a processing content to be performed determined through theplurality of condition judgments and branches based on the combinationof the values of the plurality of pieces of determination data includedin the reference data, the reference data and the processing contentbeing related to each other, and outputting a processing content to beperformed related to the reference data that matches the comparisontarget data.

When there is a piece of determination data that is not used in theplurality of condition judgments and branches within the combination ofthe values of the plurality of pieces of determination data included inreference data, the piece of determination data may be masked therein.

Still yet another aspect of the present invention also relates to adetermination method. The determination method comprises: extracting,when processing to be performed is determined through a plurality ofcondition judgments and branches, comparison target data predefined soas to include a plurality of pieces of determination data used for thecondition judgments and branches, from acquired data; and collectivelyconducting the plurality of condition judgments and branches bysearching for the comparison target data, in which each piece of dataother than the plurality of pieces of determination data is masked,within a database, which stores reference data having a data lengthidentical with that of the comparison target data and containing apossible value of each of the plurality of pieces of determination dataat the position of the piece of determination data and which also storesa processing content to be performed determined through the plurality ofcondition judgments and branches based on the combination of the valuesof the plurality of pieces of determination data included in thereference data, the reference data and the processing content beingrelated to each other, and outputting a processing content to beperformed related to the reference data that matches the comparisontarget data.

The determination method may further comprise specifying a plurality ofpieces of determination data to be extracted in the extracting. In thecase where a plurality of the databases are provided and when aplurality of pieces of determination data to be extracted in theextracting are changed, a database to be searched may be also replacedin the specifying accordingly.

The determination method may further comprise reporting, when thecomparison target data does not match any of the reference data, thefact. Also, The determination method may further comprise generating,when it is reported that the comparison target data has not matched anyof the reference data, a new database in which is added a record inregard to such comparison target data, so as to update the database.

Optional combinations of the aforementioned constituting elements, andimplementations of the invention in the form of methods, apparatuses,systems, recording mediums and computer programs may also be practicedas additional modes of the present invention.

ADVANTAGEOUS EFFECTS

The present invention provides a technique for determining processing tobe performed at high speed.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram that shows a configuration of a communicationcontrol system according to a base technology.

FIG. 2 is a diagram that shows a configuration of a conventionalcommunication control apparatus.

FIG. 3 is a diagram that shows a configuration of a communicationcontrol apparatus according to the base technology.

FIG. 4 is a diagram that shows a configuration of a packet processingcircuit.

FIG. 5 is a diagram that shows a configuration of a position detectioncircuit.

FIG. 6 is a diagram that shows another example of the position detectioncircuit.

FIG. 7 is a diagram that shows yet another example of the positiondetection circuit.

FIG. 8 is a diagram that shows an example of internal data of a firstdatabase.

FIG. 9 is a diagram that shows another example of internal data of thefirst database.

FIG. 10 is a diagram that shows yet another example of internal data ofthe first database.

FIG. 11 is a diagram that shows another example of the index circuit.

FIG. 12 is a diagram that shows a configuration of a comparison circuitincluded in a binary search circuit.

FIG. 13 is a diagram that shows a configuration of the binary searchcircuit.

FIG. 14 is a diagram that shows still yet another example of internaldata of the first database.

FIG. 15 is a diagram that shows an example of internal data of a seconddatabase.

FIG. 16 is a diagram that shows another example of internal data of thesecond database.

FIG. 17 is a diagram that shows another illustrative configuration ofthe communication control apparatus according to the base technology.

FIG. 18 is a diagram that shows a configuration of the packet processingcircuit according to an embodiment.

FIG. 19 is a diagram that shows an example of communication dataacquired by the communication control apparatus.

FIG. 20 is a diagram that shows an illustrative flowchart fordetermining processing to be performed by the communication controlapparatus.

FIG. 21 is a diagram for describing a determination method according tothe embodiment.

FIG. 22 is a diagram that shows an example of internal data of the firstdatabase and second database according to the embodiment.

FIG. 23 is a diagram that shows another example of internal data of thefirst database and second database according to the embodiment.

FIG. 24 is a diagram for describing another illustrative determinationmethod according to the embodiment.

FIG. 25 is a diagram that shows yet another example of internal data ofthe first database and second database according to the embodiment.

FIG. 26 is a diagram that shows another illustrative configuration ofthe packet processing circuit according to the embodiment.

FIG. 27 is a diagram for describing yet another illustrativedetermination method according to the embodiment.

FIG. 28 is a diagram that shows yet another illustrative configurationof the packet processing circuit according to the embodiment.

EXPLANATION OF REFERENCE NUMERALS

-   -   10 communication control apparatus    -   20 packet processing circuit    -   30 search circuit    -   32 position detection circuit    -   33 comparison circuit    -   34 index circuit    -   35 comparison circuit    -   36 binary search circuit    -   36A, 36B and 36C comparison circuits    -   36Z control circuit    -   40 process execution circuit    -   50 first database    -   60 second database    -   100 communication control system    -   110 operation monitoring server    -   120 connection management server    -   130 message output server    -   140 log management server    -   150 database server    -   300 comparison target extraction circuit    -   310 communication data    -   320 comparison target data    -   330 comparison target setting circuit    -   340 reporting circuit

BEST MODE FOR CARRYING OUT THE INVENTION Base Technology

First, as a base technology, the configurations and the outline ofoperation of a communication control apparatus and its peripheralapparatuses will be described.

FIG. 1 shows a configuration of a communication control system accordingto the base technology. A communication control system 100 comprises acommunication control apparatus 10 and various peripheral apparatusesprovided to support the operation of the communication control apparatus10. The communication control apparatus 10 of the base technologyperforms a packet filtering function provided by an Internet serviceprovider or the like. The communication control apparatus 10 provided ona network path acquires a packet transmitted via the network, analyzesthe content, and determines whether or not the packet communicationshould be permitted. If the communication is permitted, thecommunication control apparatus 10 will transmit the packet to thenetwork. If the communication is prohibited, the communication controlapparatus 10 will discard the packet and return a warning message or thelike to the transmission source of the packet if necessary.

The communication control system 100 of the base technology includesmultiple communication control apparatuses 10 a, 10 b, 10 c, etc. andoperates them functioning as one communication control apparatus 10.Hereinafter, each of the communication control apparatuses 10 a, 10 b,10 c, etc. and their collective body will be both referred to as acommunication control apparatus 10 with no distinction.

In the communication control system 100 of the base technology, eachcommunication control apparatus 10 stores the respective shares of atleast part of databases necessary for packet processing; there areprovided as many as the number of communication control apparatuses 10required to share and store such databases, and at least one moreapparatus is provided extra. For example, when the number of pieces ofdata is 300,000 or above but less than 400,000, the number ofcommunication control apparatuses required for operation is four.However, one or more communication control apparatuses 10 should befurther provided as standby units in case any of the communicationcontrol apparatuses 10 in operation fails or in case a database in anyof the communication control apparatuses 10 is updated. Accordingly, atleast five communication control apparatuses 10 are provided in total.Conventionally, the entire system has needed to be duplexed consideringfault tolerance. According to the technique of the base technology, incontrast, a divided unit of the communication control apparatus 10 maybe only provided extra, thereby enabling cost reduction. The operatingstate of the multiple communication control apparatuses 10 a, 10 b, 10c, etc. is managed by an operation monitoring server 110. The operationmonitoring server 110 of the base technology has a management table formanaging the operating state of the communication control apparatuses.

The peripheral apparatuses include the operation monitoring server 110,a connection management server 120, a message output server 130, a logmanagement server 140 and a database server 150. The connectionmanagement server 120 manages connection to the communication controlapparatus 10. When the communication control apparatus 10 processes apacket transmitted from a cellular phone terminal, for example, theconnection management server 120 authenticates the user as a userentitled to enjoy the service of the communication control system 100,based on information included in the packet, which uniquely identifiesthe cellular phone terminal. Once the user is authenticated, packetstransmitted from the IP address, which is temporarily provided for thecellular phone terminal, will be transmitted to the communicationcontrol apparatus 10 and processed therein, without being authenticatedby the connection management server 120 during a certain period. Themessage output server 130 outputs a message to the destination or thesource of packet transmission, according to whether the communicationcontrol apparatus 10 has permitted the packet communication. The logmanagement server 140 manages the operating history of the communicationcontrol apparatus 10. The database server 150 acquires the latestdatabase from an external source and provides the database to thecommunication control apparatus 10. To update the database withouthalting the operation of the communication control apparatus 10, theapparatus may possess a backup database. The operation monitoring server110 monitors the operating state of the communication control apparatus10 and its peripheral apparatuses including the connection managementserver 120, message output server 130, log management server 140 anddatabase server 150. The operation monitoring server 110 has the highestpriority in the communication control system 100 and performssupervisory control of the communication control apparatus 10 and allthe peripheral apparatuses. Although the communication control apparatus10 is configured with a dedicated hardware circuit, as will be describedlater, the operation monitoring server 110 can monitor the operatingstate even while the communication control apparatus 10 is in operation,by inputting to or outputting from the communication control apparatus10 the data for monitoring by means of a boundary-scan circuit based onthe technique described in Japanese Patent No. 3041340 filed by thepresent applicant or other techniques.

In the communication control system 100 of the base technology, as willbe described below, the communication control apparatus 10, configuredwith a dedicated hardware circuit for faster operation, is controlled byusing a group of peripheral servers connected thereto and having variousfunctions. Accordingly, by suitably replacing the software of the groupof servers, a wide variety of functions can be achieved with a similarconfiguration. Thus, the base technology provides such communicationcontrol system having high flexibility.

FIG. 2 shows a configuration of a conventional communication controlapparatus 1. The conventional communication control apparatus 1comprises a communication control unit 2 on the receiving side, a packetprocessing unit 3, and a communication control unit 4 on the sendingside. The communication control units 2 and 4 include PHY processingunits 5 a and 5 b for performing physical layer processing of packets,and MAC processing units 6 a and 6 b for performing MAC layer processingof packets, respectively. The packet processing unit 3 includes protocolprocessing units for performing protocol-specific processing, such as anIP processing unit 7 for performing IP (Internet Protocol) processingand a TCP processing unit 8 for performing TCP (Transport ControlProtocol) processing. The packet processing unit 3 also includes an APprocessing unit 9 for performing application layer processing. The APprocessing unit 9 performs filtering or other processing according todata included in a packet.

The packet processing unit 3 of the conventional communication controlapparatus 1 is implemented by software, using a general-purposeprocessor, or CPU, and an OS running on the CPU. With suchconfiguration, however, the performance of the communication controlapparatus 1 depends on the performance of the CPU, hampering thecreation of a communication control apparatus capable of high-speedprocessing of a large volume of packets. For example, a 64-bit CPU canprocess only up to 64 bits at a time, and hence, there has existed nocommunication control apparatus having a higher performance than this.In addition, since the conventional communication control apparatus ispredicated on the presence of an OS with versatile functionality, thepossibility of security holes cannot be eliminated completely, requiringmaintenance work including OS upgrades.

FIG. 3 shows a configuration of a communication control apparatusaccording to the base technology. A communication control apparatus 10of the base technology comprises a packet processing circuit 20configured with dedicated hardware employing a wired logic circuit,instead of a packet processing unit that is implemented by softwareincluding a CPU and an OS in a conventional communication controlapparatus. By providing a dedicated hardware circuit to processcommunication data, rather than processing it with an OS and softwarerunning on a general-purpose processing circuit such as CPU, theperformance limitations posed by the CPU or OS can be overcome, enablinga communication control apparatus having high throughput.

For example, a case will be considered here in which search is conductedin packet filtering or the like to check if the data in a packetincludes reference data, which serves as a criterion for filtering. Whena CPU is used to compare the communication data with the reference data,there occurs a problem in that, since only 64-bit data can be comparedat a time, the processing speed cannot be improved beyond such CPUperformance. Since the CPU needs to repeat the process of loading 64bits of communication data into a memory and comparing it with thereference data, the memory load time becomes a bottleneck that limitsthe processing speed.

In the base technology, by contrast, a dedicated hardware circuitconfigured with a wired logic circuit is provided to comparecommunication data with reference data.

This circuit includes multiple comparators arranged in parallel, so asto enable the comparison of data having a length greater than 64 bits,such as 1024 bits. By providing dedicated hardware in such manner, bitmatching can be simultaneously performed on a large number of bits inparallel. Since 1024-bit data can be processed at a time, while theconventional communication control apparatus 1 using a CPU processesonly 64 bits, the processing speed can be improved remarkably.Increasing the number of comparators will improve the throughput, butalso increase the cost and size of the apparatus. Accordingly, anoptimal hardware circuit may be designed in accordance with the desiredperformance, cost or size.

Since the communication control apparatus 10 of the base technology isconfigured with dedicated hardware employing a wired logic circuit, itdoes not require any OS (Operating System). This can eliminate the needfor the installation, bug fixes, or version upgrades of an OS, therebyreducing the cost and man-hours required for administration andmaintenance. Also, unlike CPUs requiring versatile functionality, thecommunication control apparatus 10 does not include any unnecessaryfunctions or use needless resources, and hence, reduced cost, a smallercircuit area or improved processing speed can be expected. Furthermore,again unlike conventional OS-based communication control apparatuses,the absence of unnecessary functions decreases the possibility ofsecurity holes and thus enhances the tolerance against attacks frommalicious third parties over a network.

The conventional communication control apparatus 1 processes packetsusing software predicated on a CPU and an OS. Therefore, all packet dataneeds to be received before protocol processing is performed, and thenthe data is passed to an application. In contrast, since packetprocessing is performed by a dedicated hardware circuit in thecommunication control apparatus 10 of the base technology, all packetdata need not be received before starting the processing; upon receptionof necessary data, the processing can be started at any given point intime without waiting for the reception of subsequent data. For example,position detection processing in a position detection circuit, whichwill be described later, may be started at the time when positionidentification data for identifying the position of comparison targetdata is received. Thus, various types of processing can be performed inparallel without waiting for the reception of all data, reducing thetime required to process packet data.

FIG. 4 shows an internal configuration of the packet processing circuit.The packet processing circuit 20 comprises: first databases 50A, 50B and50C (hereinafter, they may be collectively referred to as “firstdatabases 50”) for storing reference data, which is referred to whenprocessing to be performed on communication data is determined; a searchcircuit 30 for searching received communication data for the referencedata by comparing the two; a second database 60 for storing a searchresult of the search circuit 30 and a content of processing to beperformed on the communication data, which are related to each other;and a process execution circuit 40 for processing the communication databased on the search result of the search circuit 30 and the conditionsstored in the second database 60.

The search circuit 30 includes: a position detection circuit 32 fordetecting the position of comparison target data, which is to becompared with reference data, in communication data; an index circuit 34which serves as an example of a determination circuit that determineswhich range the comparison target data belongs to among three or moreranges, into which the reference data stored in the first database 50 isdivided; and a binary search circuit 36 for searching the determinedrange for the reference data that matches the comparison target data.The reference data may be searched for the comparison target data usingany search technique, and a binary search method is used in the basetechnology. Since an improved binary search method is employed, as willbe discussed later, three first databases 50 are provided in the basetechnology. The first databases 50A, 50B and 50C store the samereference data.

FIG. 5 shows an internal configuration of the position detectioncircuit. The position detection circuit 32 includes multiple comparisoncircuits 33 a-33 f that compare communication data with positionidentification data for identifying the position of comparison targetdata. While six comparison circuits 33 a-33 f are provided here, thenumber of comparison circuits may be arbitrary, as will be describedlater. To the comparison circuits 33 a-33 f are input pieces ofcommunication data, with each piece shifted from the preceding one by apredetermined data length, such as 1 byte. These multiple comparisoncircuits 33 a-33 f then simultaneously compare the respectivecommunication data with the position identification data to be detectedin parallel.

The base technology will be described by way of example for explainingthe operation of the communication control apparatus 10, in which acharacter string “No. ###” in communication data is detected, the number“###” included in the character string is then compared with referencedata, and if the number matches the reference data, the packet will beallowed to pass, while, if they do not match, the packet will bediscarded.

In the example of FIG. 5, communication data “01No. 361 . . . ” is inputto the comparison circuits 33 a-33 f with a shift of one character each,and position identification data “No.” for identifying the position ofthe number “###” is sought to be detected in the communication data.More specifically, “01N” is input to the comparison circuit 33 a, “1No”to the comparison circuit 33 b, “No.” to the comparison circuit 33 c,“o.” to the comparison circuit 33 d, “. 3” to the comparison circuit 33e, and “36” to the comparison circuit 33 f. Then, the comparisoncircuits 33 a-33 f simultaneously perform comparisons with the positionidentification data “No.”. Consequently, there is found a match with thecomparison circuit 33 c, indicating that the character string “No.”exists at the third character from the top of the communication data.Thus, it is found that the numeral data as comparison target data existssubsequent to the position identification data “No.” detected by theposition detection circuit 32.

When the same processing is performed by a CPU, since the comparisonprocess needs to be serially performed one by one from the top, such ascomparing character strings “01N” and “No.” before comparing “1No” and“No.”, no improvement of detection speed can be expected. In thecommunication control apparatus 10 of the base technology, in contrast,providing the multiple comparison circuits 33 a-33 f in parallel enablessimultaneous parallel comparison processing, which could not have beenperformed with a CPU, improving the processing speed significantly.Providing more comparison circuits will improve the detection speed, asmore characters can be compared simultaneously. In consideration of costor size, a sufficient number of comparison circuits may be provided toachieve a desired detection speed.

Aside from detecting position identification data, the positiondetection circuit 32 may also be used as a circuit for detectingcharacter strings for various purposes. Moreover, the position detectioncircuit 32 may be configured to detect position identification data inunits of bits, not just as a character string.

FIG. 6 shows another example of the position detection circuit. In theexample shown in FIG. 6, when the data length of position identificationdata is shorter than that prepared in each of the comparison circuits 33a-33 f in the position detection circuit 32, the remaining positions arepadded with predetermined data, such as “00H” or “01H”, posterior to theposition identification data. Similarly, with regard to communicationdata to be compared with position identification data, a data lengthidentical with that of the position identification data is extractedfrom the communication data and input to a comparison circuit, and theremaining positions posterior to the extracted data are padded with thesame data as used for the padding in the position identification data.In such case, the communication data may be copied as work, and thecopied data may be processed to be input to the comparison circuits 33a-33 f, so as not to change the original communication data. Thus, theposition detection circuit 32 can be generally used regardless of thelength of position identification data.

FIG. 7 shows yet another example of the position detection circuit. Inthe example shown in FIG. 7, the remaining positions posterior toposition identification data are padded with predetermined data in thesame way as shown in the example of FIG. 6, and, in addition, such datais regarded as a wild card. That is, when data is input as a wild cardinto the comparison circuits 33 a-33 f, it is determined that thecorresponding part of target data to be compared matches the wild-carddata whatever the target data is. Thus, the position detection circuit32 can be generally used regardless of the length of positionidentification data.

FIG. 8 shows an example of internal data of the first database. Thefirst database 50 stores reference data, which is referred to whenprocessing on packets, such as filtering, routing, switching, orreplacement, is determined. The pieces of reference data are sortedaccording to some sort conditions and stored in ascending or descendingorder. In the example of FIG. 8, 1000 pieces of reference data arestored.

The index circuit 34 determines which range comparison target databelongs to among three or more ranges, such as 52 a-52 d, into whichreference data stored in the first database 50 is divided. In theexample of FIG. 8, the 1000 pieces of reference data are divided intofour ranges 52 a-52 d, i.e., 250 pieces each in a range. The indexcircuit 34 includes multiple comparison circuits 35 a-35 c, each ofwhich compares a piece of reference data at the border of the range withthe comparison target data. Since the comparison circuits 35 a-35 csimultaneously compare the pieces of reference data at the borders withthe comparison target data in parallel, which range the comparisontarget data belongs to can be determined by a single operation ofcomparison processing.

The pieces of reference data at the borders to be input to thecomparison circuits 35 a-35 c of the index circuit 34 may be set by anapparatus provided outside the communication control apparatus 10.Alternatively, reference data at predetermined positions in the firstdatabase 50 may be set in advance to be automatically input as such. Inthe latter case, even when the first database 50 is updated, thereference data at the predetermined positions in the first database 50are automatically input to the comparison circuits 35 a-35 c. Therefore,the communication control processing can be performed immediatelywithout initialization or the like.

As mentioned previously, CPU-based binary search cannot make multiplecomparisons at the same time. In the communication control apparatus 10of the base technology, in contrast, providing the multiple comparisoncircuits 35 a-35 c in parallel enables simultaneous parallel comparisonprocessing, with a significant improvement in the search speed.

After the index circuit 34 determines the relevant range, the binarysearch circuit 36 performs search using a binary search method. Thebinary search circuit 36 divides the range determined by the indexcircuit 34 further into 2^(n) and subsequently compares the pieces ofreference data lying at the borders with the comparison target data,thereby determining which range the comparison target data belongs to.The binary search circuit 36 includes multiple comparators forcomparing, bit by bit, reference data with comparison target data. Forexample, in the base technology are provided 1024 comparators to performbit matching on 1024 bits simultaneously. When the range to which thecomparison target data belongs is determined among the 2^(n) splitranges, the determined range is further divided into 2^(n). Then, thepieces of reference data lying at the borders are read out to becompared with the comparison target data. Thereafter, this processing isrepeated to narrow the range further until reference data that matchesthe comparison target data is eventually found.

The operation will now be described in more detail in conjunction withthe foregoing example. Each of the comparison circuits 35 a-35 c of theindex circuit 34 receives “361” as comparison target data. As forreference data, the comparison circuit 35 a receives “378”, which liesat the border of the ranges 52 a and 52 b. Similarly, the comparisoncircuit 35 b receives reference data “704” lying at the border of theranges 52 b and 52 c, and the comparison circuit 35 c receives referencedata “937” lying at the border of the ranges 52 c and 52 d. Thecomparison circuits 35 a-35 c then perform comparisons simultaneously,determining that the comparison target data “361” belongs to the range52 a. Subsequently, the binary search circuit 36 searches the referencedata for the comparison target data “361”.

FIG. 9 shows another example of internal data of the first database. Inthe example shown in FIG. 9, the number of pieces of reference data issmaller than the number of pieces of data storable in the first database50, i.e., 1000 in this case. In such instance, the first database 50stores the pieces of reference data in descending order, starting withthe last data position therein. Then, 0 is stored in the rest of thedata positions. The database is loaded with data not from the top butfrom the bottom of the loading area, and all the vacancies occurring inthe front of the loading area, if any, are replaced with zero.Consequently, the database is fully loaded at any time, so that thesearch time necessary for a binary search will be constant. Moreover, ifthe binary search circuit 36 reads reference data “0” during a search,the circuit can identify the range without making a comparison, as thecomparison result is obvious, and can proceed to the next comparison.Consequently, the search speed can be improved.

In CPU-based software processing, the first database 50 stores pieces ofreference data in ascending order, from the first data position therein.In the rest of data positions will be stored a maximum value or thelike, and in such case, the skip of comparison processing as describedabove cannot be made during a binary search. The comparison techniquedescribed above can be implemented by configuring the search circuit 30with a dedicated hardware circuit.

FIG. 10 shows yet another example of internal data of the firstdatabase. In the example shown in FIG. 10, the reference data is notevenly divided into three or more ranges, but unevenly divided intoranges that accommodate different numbers of pieces of data, such as 500pieces in the range 52 a and 100 pieces in the range 52 b. These rangesmay be determined depending on the distribution of frequencies withwhich reference data occurs in communication data. Specifically, theranges may be determined so that the sums of the frequencies ofoccurrence of reference data belonging to the respective ranges arealmost the same. Accordingly, the search efficiency can be improved. Thereference data to be input to the comparison circuits 35 a-35 c of theindex circuit 34 may be modifiable from the outside. In such case, theranges can be dynamically set, so that the search efficiency will beoptimized.

FIG. 11 shows another example of the index circuit. In the examples ofFIGS. 8-10, the index circuit 34 uses the three comparison circuits 35a-35 c to determine which range comparison target data belongs to amongthe four ranges of 52 a-52 d in the first database 50. In the exampleshown in FIG. 11, on the other hand, the index circuit 34 is providedwith four comparison circuits 35 d-35 g for determining whether or notcomparison target data is included in each of the four ranges 52 a-52 d.For example, into the comparison circuit 35 d are input the 0th and250th pieces of reference data in the first database 50 and comparisontarget data. Then, each piece of the reference data is compared to thecomparison target data, so as to determine whether or not the referencedata is included in the range 52 a. The comparison results provided bythe comparison circuits 35 d-35 g are input into a determination circuit35 z, which outputs information providing which range the reference datais included in. Each of the comparison circuits 35 d-35 g may output aresult indicating whether the reference data is included between the twoinput pieces of reference data, or may output a result indicating thatthe reference data is greater than the range, the reference data isincluded in the range, or the reference data is smaller than the range.When it is determined that the comparison target data is not included inany of the ranges 52 a-52 d, it can be found that the comparison targetdata does not exist within the first database 50. Accordingly, thesearch can be terminated without performing any further binary search.

FIG. 12 shows a configuration of a comparison circuit included in thebinary search circuit. As mentioned previously, a comparison circuit inthe binary search circuit 36 includes 1024 comparators, such as 36 a, 36b, . . . . Each of the comparators 36 a, 36 b, etc. receives 1 bit ofreference data 54 and 1 bit of comparison target data 56 to compare thebits in value. The comparison circuits 35 a-35 c of the index circuit 34have similar internal configurations. Since the comparison processing isthus performed by a dedicated hardware circuit, a large number ofcomparison circuits can be operated in parallel to compare a largenumber of bits at a time, thereby speeding up the comparison processing.

FIG. 13 shows a configuration of the binary search circuit. The binarysearch circuit 36 includes comparison circuits 36A, 36B and 36C, each ofwhich includes the 1024 comparators 36 a, 36 b, etc. as shown in FIG.12, and a control circuit 36Z for controlling the comparison circuits.

In a conventional binary search method, a piece of data lying at theone-half position in the search range of a database, in which pieces ofdata are aligned in ascending or descending order, is read out to becompared with comparison target data in the first search. When thepieces of data are aligned in ascending order and if the comparisontarget data is smaller than the read out data, it means that thecomparison target data might exist within the first half of the searchrange. Accordingly, in the second search, the search range is newly setto the first half and a piece of data lying at the one-half position inthe range, i.e. at the one-quarter position in the original searchrange, is read out to be compared with the comparison target data.Conversely, if the comparison target data is greater than the read outdata, it means that the comparison target data might exist within thesecond half of the search range. Accordingly, the new search range isset to the second half and a piece of data lying at the one-halfposition in the range, i.e. at the three-quarter position in theoriginal search range, is read out to be compared with the comparisontarget data in the second search. In this way, the search range isnarrowed by half repeatedly until the target data is reached.

In the base technology, in contrast, three comparison circuits areprovided for binary search, so that when the data at the one-halfposition in the search range is compared with comparison target data forthe first search, the comparison for the second search between thecomparison target data and each of the pieces of data at the one-quarterand three-quarter positions in the search range can be simultaneouslyperformed in parallel. Thus, the first and second searches can beperformed at the same time, thereby reducing the time required to loadthe data from the database. Also, by operating three comparison circuitsin parallel, the number of comparisons can be reduced by half, therebyreducing the search time.

In the example of FIG. 13, three comparison circuits are provided toperform two searches simultaneously. When n searches are to be performedsimultaneously, 2^(n)−1 comparison circuits may be generally provided.The control circuit 36Z inputs each piece of data at the 1/2^(n),2/2^(n), . . . , and (2^(n)−1)/2^(n) positions in the search range intothe 2^(n)−1 comparison circuits respectively, and operates thecomparison circuits simultaneously in parallel to allow them to comparethe respective pieces of data with comparison target data. The controlcircuit 36Z then acquires the comparison results from the comparisoncircuits and determines if the comparison target data is found. If anyof the comparison circuits output a signal indicating that there hasbeen a data match, the control circuit 36Z will determine that thecomparison target data has been found and will terminate the binarysearch. If there is no such signal output, the process will be shiftedto the next search. If the comparison target data exists within thedatabase, the data must lie within a range between points where thecomparison results of the 2^(n)−1 comparison circuits change. In thecase where 15 comparison circuits are provided, for example, if thepiece of data at the 5/16 position is smaller than comparison targetdata and if the piece of data at the 6/16 position is greater than thecomparison target data, the comparison target data should lie within therange between the 5/16 and 6/16 positions. Thus, the control circuit 36Zacquires comparison results from the comparison circuits and sets thenext search range to a range between points where the comparison resultschange. The control circuit 36Z then inputs, into the respectivecomparison circuits, each piece of data at the 1/2^(n), 2/2^(n), . . . ,and (2^(n)−1)/2^(n) positions in the next search range thus set.

There are provided the three first databases 50 in the base technology:the first database 50A is connected to the comparison circuit 36A andsupplies thereto a piece of data at the one-quarter position in thesearch range; the first database 50B is connected to the comparisoncircuit 36B and supplies thereto a piece of data at the two-quarterposition in the search range; and the first database 50C is connected tothe comparison circuit 36C and supplies thereto a piece of data at thethree-quarter position in the search range. Therefore, pieces of datacan be loaded simultaneously into the comparison circuits in parallel,thereby further reducing the time for data loading and enablinghigh-speed binary search.

Providing more comparison circuits will improve the search speed. Inconsideration of cost or size of the system, a sufficient number ofcomparison circuits may be provided to achieve a desired search speed.Also, although it is desirable that first databases as many ascomparison circuits are provided, some comparison circuits may share adatabase in consideration of cost or size of the system.

FIG. 14 shows still yet another example of internal data of the firstdatabase. The first database 50 shown in FIG. 14 stores URLs of contentsto which filtering is applied. The data stored in the first database 50may include predetermined data recognized as a wild card, such as “00H”or “01H”. In the example shown in FIG. 14, “*********” is recognized asa wild card in “http://www.xx.xx/*********”, and, whatever thecomparison target data corresponding thereto is, it is determined in thecomparators 36 a, 36 b, etc. that such data matches the wild card.Accordingly, every character string starting with “http://www.xx.xx/” isdetected by the binary search circuit 36. Consequently, processing suchas applying filtering to all contents within the domain“http://www.xx.xx/” can be easily performed.

FIG. 15 shows an example of internal data of the second database. Thesecond database 60 includes a search result field 62, which contains asearch result of the search circuit 30, and a processing content field64, which contains a processing content to be performed on communicationdata. The database stores the search results and the processing contentsrelated to each other. In the example of FIG. 15, conditions areestablished such that a packet will be allowed to pass if itscommunication data contains reference data; if not, the packet will bediscarded. The process execution circuit 40 searches the second database60 for a processing content based on the search result and performs theprocessing on the communication data. The process execution circuit 40may also be configured with a wired logic circuit.

FIG. 16 shows another example of internal data of the second database.In the example of FIG. 16, the processing content is set for each pieceof reference data. With regard to packet replacement, replacement datamay be stored in the second database 60. As for packet routing orswitching, information on the route may be stored in the second database60. The process execution circuit 40 performs processing, such asfiltering, routing, switching, or replacement, which is specified in thesecond database 60, in accordance with the search result of the searchcircuit 30. When the processing content is set for each piece ofreference data, as shown in FIG. 16, the first database 50 and thesecond database 60 may be merged with each other.

The first database and the second database are configured to berewritable from the outside. By replacing these databases, various typesof data processing and communication control can be achieved using thesame communication control apparatus 10. Also, multistage searchprocessing may be performed by providing two or more databases thatstore reference data to be searched. In such instance, more complicatedconditional branching may be performed by providing two or moredatabases that store search results and processing contents related toeach other. When multiple databases are thus provided to conductmultistage search, a plurality of the position detection circuits 32,the index circuits 34, the binary search circuits 36, etc. may also beprovided.

The data intended for the foregoing comparison may be compressed by thesame compression logic. If both the source data and the target data tobe compared are compressed by the same method, the comparison can beperformed in the same manner as usual, thus reducing the amount of datato be loaded for comparison. The smaller amount of data to be loaded canreduce the time required to read out the data from the memory, therebyreducing the overall processing time. Moreover, the number ofcomparators can be also reduced, which contributes to theminiaturization, weight saving, and cost reduction of the apparatus. Thedata intended for comparison may be stored in a compressed form, or maybe read out from the memory and compressed before comparison.

FIG. 17 shows another illustrative configuration of the communicationcontrol apparatus in the base technology. The communication controlapparatus 10 shown in this diagram has two communication control units12, each of which has the same configuration as the communicationcontrol apparatus 10 shown in FIG. 4. There is also provided a switchcontrol unit 14 for controlling the operation of the individualcommunication control units 12. Each of the communication control units12 has two input/output interfaces 16 and is connected to two networks,upstream and downstream, via the respective input/output interfaces 16.The communication control units 12 receive communication data fromeither one of the networks and output processed data to the other. Theswitch control unit 14 switches the inputs and outputs of theinput/output interfaces 16 provided for the individual communicationcontrol units 12, thereby switching the directions of the flow ofcommunication data in the communication control units 12. This allowscommunication control not only in one direction but also in bothdirections.

The switch control unit 14 may provide control such that: either one ofthe communication control units 12 processes inbound packets and theother processes outbound packets; both the units process inboundpackets; or both the units process outbound packets. Consequently, thedirections of communications to control can be changed depending on, forexample, the traffic status or intended purpose.

The switch control unit 14 may acquire the operating state of therespective communication control units 12 and may switch the directionof communication control according thereto. For example, when one of thecommunication control units 12 is in a standby state and the othercommunication control unit 12 is in operation, the unit on standby maybe activated as a substitute upon detection of the unit in operationstopping due to a failure or other reasons. This can improve the faulttolerance of the communication control apparatus 10. Also when one ofthe communication control units 12 needs maintenance such as a databaseupdate, the other communication control unit 12 may be operated as asubstitute. Thus, appropriate maintenance can be performed withouthalting the operation of the communication control apparatus 10.

The communication control apparatus 10 may be provided with three ormore communication control units 12. The switch control unit 14 may, forexample, acquire the traffic status to control the direction ofcommunications in the respective communication control units 12 so thatmore communication control units 12 are allocated for communicationcontrol processing in a direction handling higher traffic. Thisminimizes a drop in the communication speed, even when the trafficincreases in one direction.

Embodiment

There will be described a technique for determining, at high speed,processing to be performed by the communication control apparatus 10discussed above.

FIG. 18 shows a configuration of the packet processing circuit 20according to the embodiment. The packet processing circuit 20 shown inFIG. 18 is an example of the determination apparatus according to thepresent invention and comprises a comparison target extraction circuit300 in addition to the configuration of the packet processing circuit 20according to the base technology shown in FIG. 4. Other configurationsand operations are the same as those in the base technology.

FIG. 19 shows an example of communication data acquired by thecommunication control apparatus 10. Communication data 310 contains dataaligned according to a packet layout that depends on the type of thecommunication protocol. For the sake of convenience, data areas arenumbered in FIG. 19. For example, data of which the data area isnumbered “1” is described “Data 1”.

FIG. 20 shows an illustrative flowchart for determining processing to beperformed by the communication control apparatus 10. In the example ofFIG. 20, Data 1, Data 5, and Data 7 in the communication data 310acquired by the communication control apparatus 10 are used asdetermination criteria, and multiple condition judgments and branchesare conducted based on such data so as to determine processing to beperformed. When a series of processes is performed according to thisflowchart, two or three condition judgments and branches need beconducted.

FIG. 21 is a diagram for describing a determination method according tothe present embodiment. The comparison target extraction circuit 300extracts, from communication data 310 acquired by the communicationcontrol apparatus 10, multiple pieces of determination data, which areused to determine processing to be performed, and connects such piecesso as to generate comparison target data 320. In the example accordingto the flowchart shown in FIG. 20, “A” of Data 1, “E” of Data 5, and “F”of Data 7 are extracted from the communication data 310 and connectedwith each other, so that “AEF” is generated as the comparison targetdata 320. The comparison target extraction circuit 300 then provides thecomparison target data 320 thus generated to the index circuit 34 andbinary search circuit 36. When extracting determination data from thecommunication data 310, the comparison target extraction circuit 300 maydetect the position of the determination data using the positiondetection circuit 32.

FIG. 22 shows an example of internal data of the first database 50 andsecond database 60 according to the present embodiment. The firstdatabase 50 stores reference data that is generated by connecting apossible value of each of Data 1, Data 5, and Data 7. The seconddatabase 60 stores a processing content to be performed, which isdetermined through multiple condition judgments and branches based on acombination of the values of Data 1, Data 5, and Data 7 according to theflowchart of FIG. 20 and which is related to reference data. Forexample, if the combination is “A” of Data 1, “E” of Data 5, and “F” ofData 7, the reference data will be “AEF” and the processing content tobe performed will be “Process a and Process e”, as can be confirmed inthe flowchart of FIG. 20. The binary search circuit 36 collectivelyconducts multiple condition judgments and branches by searching thefirst database 50 for comparison target data 320 generated by thecomparison target extraction circuit 300, and outputs a processingcontent to be performed related to reference data that matches thecomparison target data. The process execution circuit 40 then performsthe processing content thus determined by the search circuit 30.

In this way, pieces of data that serve as determination criteria areextracted from communication data and connected with each other so as togenerate comparison target data, and a database storing pieces ofcomparison target data expected to be generated is also prepared inadvance, so that multiple condition judgments and branches fordetermining processing to be performed can be collectively conductedinstead of being sequentially conducted. Thus, processing to beperformed can be determined at high speed.

Also, the logic including multiple condition judgments and branches canbe replaced by data, so that, when the logic is changed, only the firstdatabase 50 or second database 60 may be changed instead of the wholesoftware being changed. Accordingly, man-hours can be reduced.

FIG. 23 shows another example of internal data of the first database 50and second database 60 according to the present embodiment. In theexample of FIG. 23, when there is a piece of determination data that isnot used in multiple condition judgments and branches within thecombination of the values of multiple pieces of determination dataincluded in reference data, such piece of determination data is maskedtherein. For example, if Data 1 is “A” in the flowchart shown in FIG.20, the condition judgment and branch with respect to Data 5 need not beconducted, and hence, the result will be the same whatever Data 5 is.Accordingly, within reference data that contains “A” as Data 1, a wildcard is provided as Data 5.

When data are compared in which such mask is set, the data values atmasked positions in both comparison target data and reference data maybe replaced with a certain data value, such as “zero”, before the dataare input to comparison circuits, as described in the base technology,or a comparison circuit that handles the data value at a masked positionmay be allowed to output an output signal indicating that comparedvalues have matched. Alternatively, an output signal indicating thatcompared values have matched may be provided as the comparison resultwith respect to the data value at a masked position without theinvolvement of a comparison circuit, or a circuit that acquires anoutput signal from each of the comparison circuits to determine acomparison result may ignore a comparison result with respect to thedata value at a masked position.

By employing such configuration, the capacity of the first database 50can be reduced, and the efficiency of comparison processing can beimproved.

FIG. 24 is a diagram for describing another illustrative determinationmethod according to the present embodiment. The comparison targetextraction circuit 300 extracts, from communication data 310, comparisontarget data of a certain length starting from a certain position, whichis predefined so as to include multiple pieces of determination dataused for condition judgments and branches. In the example of FIG. 24,the data from Data 1 through Data 7 is extracted as comparison targetdata so as to include determination data of Data 1, Data 5, and Data 7.In this case, the first database 50 stores reference data of a datalength identical with that of the comparison target data, as shown inFIG. 25.

FIG. 25 shows yet another example of internal data of the first database50 and second database 60 according to the present embodiment. In theexample of FIG. 25, reference data stored includes pieces of data thatare not used as determination data. Reference data in the first database50 has a data length identical with that of the data from Data 1 throughData 7, which is extracted as comparison target data. At the position ofeach piece of determination data in reference data is provided apossible value of the piece of determination data. At the positionsother than those of determination data, wild cards are provided.

The index circuit 34 and binary search circuit 36 search the databasefor comparison target data in which each piece of data other thanmultiple pieces of determination data is masked. Accordingly, multiplecondition judgments and branches can be collectively conducted, and aprocessing content to be performed related to reference data thatmatches the comparison target data can be determined at high speed.

FIG. 26 shows another illustrative configuration of the packetprocessing circuit 20 according to the embodiment. The packet processingcircuit 20 shown in FIG. 26 comprises a comparison target settingcircuit 330 in addition to the configuration of the packet processingcircuit 20 shown in FIG. 18 and comprises multiple first databases 50 aand 50 b. The comparison target setting circuit 330 specifies data to beextracted by the comparison target extraction circuit 300. Thecomparison target extraction circuit 300 extracts data specified by thecomparison target setting circuit 330 to generate comparison targetdata. Other configurations and operations are the same as those of thepacket processing circuit 20 shown in FIG. 18.

FIG. 27 is a diagram for describing yet another illustrativedetermination method according to the present embodiment. In the exampleof FIG. 27, the comparison target setting circuit 330 sets that Data 3,Data 6, and Data 10 are extracted instead of Data 1, Data 5, and Data 7.According to the setting, the comparison target extraction circuit 300extracts Data 3, Data 6, and Data 10 from the communication data 310 togenerate comparison target data 320. Thus, pieces of determination dataextracted as comparison target data may be arbitrarily specified. Byreplacing reference data in the first database 50 in response to thesetting change, the logic for determining processing to be performed canbe easily changed.

The comparison target setting circuit 330 may dynamically change thedata to be extracted by the comparison target extraction circuit 300. Inthis case, the comparison target setting circuit 330 may dynamicallyreplace the first database 50 to be applied. Accordingly, by dynamicallychanging both the comparison target data and reference data, processingto be performed can be determined according to different logics. Forinstance, processes using multiple different communication protocols canbe performed by a single communication control apparatus 10, orfiltering processing according to settings provided by multiple userscan be performed.

FIG. 28 shows yet another illustrative configuration of the packetprocessing circuit 20 according to the embodiment. The packet processingcircuit 20 shown in FIG. 28 comprises a reporting circuit 340 inaddition to the configuration of the packet processing circuit 20 shownin FIG. 18. When comparison target data does not match any referencedata in the first database 50, the reporting circuit 340 reports it toan external apparatus. Other configurations and operations are the sameas those of the packet processing circuit 20 shown in FIG. 18.

If comparison target data does not match any reference data in the firstdatabase 50, it means that there is a defect in the logic fordetermining processing to be performed. Accordingly, by allowing thereporting circuit 340 to report the defect in such case, the firstdatabase 50 and second database 60 can be appropriately modified so thatthe defect in the logic is corrected. In the example of FIG. 28, thereporting circuit 340 reports, to the database server 150, comparisontarget data that has not matched any reference data in the firstdatabase 50. The database server 150 then receives from an operator orthe like a processing content to be performed on the comparison targetdata, adds to the first database 50 a record of reference data identicalwith the comparison target data, and stores in the second database 60the received processing content so as to be related to the referencedata. Thereafter, the database server 150 provides the modified firstdatabase 50 and second database 60 back to the communication controlapparatus 10, so as to reflect the modifications of the databases.

The present invention has been described with reference to theembodiment. The embodiment is intended to be illustrative only and itwill be obvious to those skilled in the art that various modificationsto constituting elements or processes could be developed and that suchmodifications are also within the scope of the present invention.

INDUSTRIAL APPLICABILITY

The present invention is applicable to a determination circuit fordetermining processing to be performed.

1. A determination apparatus, comprising: a comparison target extractioncircuit which, when processing to be performed is determined through aplurality of condition judgments and branches, extracts from acquireddata a plurality of pieces of determination data used for the conditionjudgments and branches and connects the plurality of pieces ofdetermination data to generate comparison target data; a database whichstores reference data generated by connecting a possible value of eachof the plurality of pieces of determination data and also stores aprocessing content to be performed determined through the plurality ofcondition judgments and branches based on the combination of the valuesof the plurality of pieces of determination data included in thereference data, the reference data and the processing content beingrelated to each other; and a search circuit which collectively conductsthe plurality of condition judgments and branches at a time by searchingthe database for the comparison target data and which outputs aprocessing content to be performed related to the reference data thatmatches the comparison target data.
 2. The determination apparatus ofclaim 1, wherein, when there is a piece of determination data that isnot used in the plurality of condition judgments and branches within thecombination of the values of the plurality of pieces of determinationdata included in reference data, the piece of determination data ismasked therein.
 3. (canceled)
 4. The determination apparatus of, claim 1further comprising a comparison target setting circuit which specifies aplurality of pieces of determination data to be extracted by thecomparison target extraction circuit.
 5. The determination apparatus ofclaim 4 comprising a plurality of the databases, wherein, when changinga plurality of pieces of determination data to be extracted by thecomparison target extraction circuit, the comparison target settingcircuit also replaces the database searched by the search circuitaccordingly.
 6. The determination apparatus of, claim 1 furthercomprising a reporting circuit which, when the comparison target datadoes not match any of the reference data, reports the fact.
 7. Thedetermination apparatus of claim 6, wherein the database is configuredto be updatable from the outside so as to be replaced by a new databasein which is added a record in regard to comparison target data that hasnot matched any of the reference data.
 8. A determination method,comprising: extracting, when processing to be performed is determinedthrough a plurality of condition judgments and branches, a plurality ofpieces of determination data used for the condition judgments andbranches from acquired data and connecting the plurality of pieces ofdetermination data to generate comparison target data; and collectivelyconducting the plurality of condition judgments and branches at a timeby searching for the comparison target data within a database, whichstores reference data generated by connecting a possible value of eachof the plurality of pieces of determination data and also stores aprocessing content to be performed determined through the plurality ofcondition judgments and branches based on the combination of the valuesof the plurality of pieces of determination data included in thereference data, the reference data and the processing content beingrelated to each other, and outputting a processing content to beperformed related to the reference data that matches the comparisontarget data.
 9. The determination method of claim 8, wherein, when thereis a piece of determination data that is not used in the plurality ofcondition judgments and branches within the combination of the values ofthe plurality of pieces of determination data included in referencedata, the piece of determination data is masked therein.
 10. (canceled)11. The determination method of, claim 8 further comprising specifying aplurality of pieces of determination data to be extracted in theextracting.
 12. The determination method of claim 11, wherein, in thecase where a plurality of the databases are provided and when aplurality of pieces of determination data to be extracted in theextracting are changed, a database to be searched is also replaced inthe specifying accordingly.
 13. The determination method of, claim 8further comprising reporting, when the comparison target data does notmatch any of the reference data, the fact.
 14. The determination methodof claim 13, further comprising generating, when it is reported that thecomparison target data has not matched any of the reference data, a newdatabase in which is added a record in regard to such comparison targetdata, so as to update the database.